Sin categoríaCriminal compliance: how a compliance programme can exempt the company from liability

Since the 2010 reform introduced the criminal liability of legal entities, and especially since the 2015 reform regulated organisation and management models, criminal compliance has ceased to be an Anglo-Saxon fashion and has become a matter of corporate survival. A company can be sentenced to multi-million fines, suspension of activities and even dissolution. And it can also be exempted from liability if it proves that it had an effective compliance programme. We explain how this system works and what the case law requires.

When a company is criminally liable

Article 31 bis of the Criminal Code establishes two routes of attribution. The first: offences committed in the name or on behalf of the company, and for its direct or indirect benefit, by its legal representatives or executives with powers of organisation and control. The second: offences committed by employees subject to the authority of the former, where the act was made possible by a serious breach of the duties of supervision, oversight and control. Not all offences give rise to corporate liability: only those the Code expressly provides for, including fraud, money laundering, offences against the Public Treasury, corruption in business, environmental offences and the discovery of secrets.

The exemption: the requirements of the prevention model

The company is exempt from liability if it proves that, before the offence was committed, it had adopted and effectively implemented an organisation and management model suitable for preventing offences of the nature of the one committed. The Code requires that model to identify the risk activities (the so-called criminal risk map), establish protocols for the formation of intent and decision-making, have adequate financial resource management models, impose the obligation to report risks and breaches through a whistleblowing channel, provide for a disciplinary system and contemplate the periodic verification and updating of the model itself. In addition, supervision must be entrusted to a body with autonomous powers, the compliance officer or compliance body, except in small companies, where the management body itself may assume it.

Key points: the programme must pre-date the offence and be genuinely implemented; the whistleblowing channel is mandatory and Law 2/2023 reinforces the protection of the whistleblower; and paper programmes not only do not exempt, they can actually be harmful.

What the case law demands: a culture of compliance

The Supreme Court has insisted, since its first judgments on the matter, that what is decisive is not the formal existence of a manual, but proof of a genuine culture of compliance: that the company is organised to detect and react to crime, and not simply decorated with documents. In forensic practice, this means the programme must be able to display evidence: minutes of the compliance body, records of staff training, internal investigations actually conducted, disciplinary sanctions imposed, reviews after incidents. A programme bought as a template and kept in a drawer will hardly withstand judicial scrutiny, and may even show that the company knew its risks and did nothing.

Practical effects: exemption, mitigation and procedural strategy

If the model met the requirements but had minor deficiencies, or was adopted after the offence though before trial, liability is mitigated. Confession, cooperation with the investigation, reparation of the damage and the establishment of effective measures to prevent future offences also mitigate. In criminal proceedings against the company, the compliance programme becomes the central piece of the corporate defence, which is autonomous and may differ from the defence of the accused executives: the interests of the legal entity and those of the individuals do not always coincide, and choosing separate defences is often indispensable.

Conclusion

Criminal compliance is today the frontier between an isolated incident involving an employee and a corporate conviction with devastating consequences. Implementing a model adapted to the real risk of the activity, resourcing it and generating evidence of its operation is the best defensive investment a company can make, whatever its size. This article is for information purposes and does not replace professional advice on a specific case.

Related: criminal compliance, corporate criminal liability and the five questions a judge asks about your compliance programme.